Are you going to religiously keep the server patched? Not only the OS, but all the other layers that will be exposed to the Internet?
This is one of the things that concerns me. If I went with the Mac Mini, OSX Server upgrades are all automated and OSX Server would be the only thing running. Whatever solution I go for, I want as minimal upkeep as possible really.
Do you fully understand the ramifications of every decision that you make while setting it up, upgrading it, configuring it?
This is why I'm asking for help really. I want the solution to be right from day one. I don't want to spend money and time setting something up to find that it doesn't quite do what I want. I also need to be able to configure it properly because obviously any changes to configuration could screw the whole system if done wrong.
Do you care about uptime? Availability? Performance?
Uptime and Availability are number one. Performance wise, as long as file access isn't ridiculous, I'm happy.
Are you going to be strict about backups? Not only running them, and ensuring they run every day, but periodically doing a test restore, and taking the backups offsite?
I'm going to be anal about backups because it won't just be our data being backed up, it will be customers data as well.
What is your strategy for securing the published server/service/website? For keeping this security up to date in the presence of constant attacks and the evolution of hackers' knowledge?
Again, this depends fully on which solution is being used. We have parts of our web servers that are not accessible by anyone but us so we block all IP addresses apart from our office and my house. This is very effective at keeping hackers away
Office 365 and equivalents offer AMAZING value for money; it's just an absolute no-brainer. As far as I'm concerned, the only reason to host your own, is if you are a tinkerer, and "want to learn", or think "you can do it better". That's fine for something with no commercial value (e.g. a lab), but for the email of a commercial entity, i.e. something that represents money (and the loss thereof), there is just no question that I want it to be reliable and secure.
You're quite right regarding the email and that's why I'm not looking to move our email from Office365 (at least not yet).
As far as the NAS goes, the Mini is vastly overkill. Since you already have it, I would probably start with it, but it's going to be much harder to setup and maintain than a NAS, which is a simple device with a single purpose, and that just does the job quietly without any fuss. NAS software upgrades are potentially automatic (e.g. done at 3am), and things like snapshots and backups are all part of the job description.
I'll give the NAS systems a good look because I wasn't aware that they took snapshorts and backups out of the box so to speak.
As a semi-related aside, I know that when you are paying for things out of your own pocket, it's easy to justify tinkering and doing it yourself. However, ask yourself this: are you serious about your business? If so, unless hosting mail/websites is your business, then is it the best use of your time to be wasting it on this, when you could be spending it on productive work that will earn you income?
You raise an excellent point - Our business is actually about 40% hosting email/websites and our hosting servers are in a secure datacentre with dedicated gigabit network ports. I wouldn't dream of hosting customers emails internally so I should eliminate hosting our own emails as well.
